@open-mercato/core 0.6.8-develop.6925.1.cefa200fa4 → 0.6.8-develop.6930.1.1e5976efc3

package/src/modules/eudr/api/statements/[id]/readiness/route.ts

@@ -0,0 +1,129 @@
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import type { NextRequest } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { EudrDueDiligenceStatement } from '../../../../data/entities'
+import { EUDR_STATEMENT_STATUSES } from '../../../../data/validators'
+import { evaluateSubmissionGate } from '../../../../lib/statement-lifecycle'
+import {
+  loadLatestAssessmentForGate,
+  loadStatementSubmissionsForGate,
+} from '../../../../commands/statements'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['eudr.statements.view'] },
+}
+
+const uuidSchema = z.string().uuid()
+
+type AuthenticatedContext = Exclude<AuthContext, null>
+
+function hasPrivilegedStatementAccess(auth: AuthenticatedContext): boolean {
+  return auth.isSuperAdmin === true
+}
+
+export async function GET(
+  req: NextRequest,
+  context: { params: Promise<{ id: string }> },
+) {
+  const { id } = await context.params
+  const { translate } = await resolveTranslations()
+  if (!uuidSchema.safeParse(id).success) {
+    return Response.json({ error: translate('eudr.errors.statement_not_found', 'Statement not found') }, { status: 404 })
+  }
+
+  const auth = await getAuthFromRequest(req)
+  if (!auth) {
+    return Response.json({ error: translate('eudr.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+
+  const statementFilter: FilterQuery<EudrDueDiligenceStatement> = {
+    id,
+    deletedAt: null,
+  }
+  if (auth.tenantId) {
+    statementFilter.tenantId = auth.tenantId
+  } else if (!auth.isSuperAdmin) {
+    return Response.json({ error: translate('eudr.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+  if (!hasPrivilegedStatementAccess(auth)) {
+    const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    if (Array.isArray(orgScope?.filterIds)) {
+      statementFilter.organizationId = { $in: orgScope.filterIds }
+    } else {
+      const organizationId = orgScope?.selectedId ?? auth.orgId
+      if (!organizationId) {
+        return Response.json({ error: translate('eudr.errors.forbidden', 'Forbidden') }, { status: 403 })
+      }
+      statementFilter.organizationId = organizationId
+    }
+  }
+
+  const statement = await em.findOne(EudrDueDiligenceStatement, statementFilter)
+  if (!statement) {
+    return Response.json({ error: translate('eudr.errors.statement_not_found', 'Statement not found') }, { status: 404 })
+  }
+
+  const referencedStatements = Array.isArray(statement.referencedStatements)
+    ? statement.referencedStatements
+    : []
+  const [submissions, latestAssessment] = await Promise.all([
+    loadStatementSubmissionsForGate(em.fork(), statement),
+    loadLatestAssessmentForGate(em.fork(), statement),
+  ])
+  const gate = evaluateSubmissionGate({
+    actorRole: statement.actorRole ?? null,
+    referencedStatementsCount: referencedStatements.length,
+    submissions,
+    latestAssessment,
+  })
+
+  return Response.json({
+    status: statement.status,
+    allowed: gate.allowed,
+    reasons: gate.reasons.map((reason) => `eudr.gate.${reason}`),
+  })
+}
+
+const errorSchema = z.object({
+  error: z.string(),
+})
+
+const readinessResponseSchema = z.object({
+  status: z.enum(EUDR_STATEMENT_STATUSES),
+  allowed: z.boolean(),
+  reasons: z.array(z.string()),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'EUDR',
+  summary: 'Evaluate the submit gate for a due diligence statement',
+  methods: {
+    GET: {
+      summary: 'Evaluate the submit gate for a due diligence statement',
+      description: 'Runs the draft→submitted gate evaluation without transitioning the statement, returning the unmet requirements as machine-readable i18n keys (eudr.gate.*). Lets the UI show a live readiness checklist before the operator attempts Submit.',
+      responses: [
+        {
+          status: 200,
+          description: 'Gate evaluation result',
+          schema: readinessResponseSchema,
+        },
+      ],
+      errors: [
+        {
+          status: 404,
+          description: 'Statement not found',
+          schema: errorSchema,
+        },
+      ],
+    },
+  },
+}

package/src/modules/eudr/api/statements/route.ts

@@ -0,0 +1,329 @@
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import { z } from 'zod'
+import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'
+import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
+import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { E } from '#generated/entities.ids.generated'
+import { EudrDueDiligenceStatement, EudrRiskAssessment } from '../../data/entities'
+import {
+  EUDR_ACTIVITY_TYPES,
+  EUDR_ACTOR_ROLES,
+  EUDR_COMMODITIES,
+  EUDR_RISK_CONCLUSIONS,
+  EUDR_RISK_TIERS,
+  EUDR_STATEMENT_STATUSES,
+  statementCreateSchema,
+  statementUpdateSchema,
+} from '../../data/validators'
+import {
+  createEudrCrudOpenApi,
+  createPagedListResponseSchema,
+  defaultOkResponseSchema,
+} from '../openapi'
+
+type TranslateFn = (key: string, fallback?: string) => string
+
+const rawBodySchema = z.object({}).passthrough()
+
+const listSchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
+  search: z.string().optional(),
+  commodity: z.enum(EUDR_COMMODITIES).optional(),
+  status: z.enum(EUDR_STATEMENT_STATUSES).optional(),
+  orderId: z.string().uuid().optional(),
+  id: z.string().uuid().optional(),
+  ids: z.string().optional(),
+  sortField: z.string().optional(),
+  sortDir: z.enum(['asc', 'desc']).optional(),
+})
+
+type StatementListQuery = z.infer<typeof listSchema>
+
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ['eudr.statements.view'] },
+  POST: { requireAuth: true, requireFeatures: ['eudr.statements.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['eudr.statements.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['eudr.statements.manage'] },
+}
+
+export const metadata = routeMetadata
+
+function toIsoString(value: unknown): string | null {
+  if (value instanceof Date) return value.toISOString()
+  if (typeof value !== 'string' || value.length === 0) return null
+  const date = new Date(value)
+  return Number.isNaN(date.getTime()) ? value : date.toISOString()
+}
+
+function asStringOrNull(value: unknown): string | null {
+  return typeof value === 'string' ? value : null
+}
+
+function resolveDeleteInput(parsed: unknown, ctx: { request?: Request }, translate: TranslateFn) {
+  const record = parsed && typeof parsed === 'object' ? parsed as Record<string, unknown> : {}
+  const body = record.body && typeof record.body === 'object' ? record.body as Record<string, unknown> : null
+  const query = record.query && typeof record.query === 'object' ? record.query as Record<string, unknown> : null
+  const requestId = ctx.request ? new URL(ctx.request.url).searchParams.get('id') : null
+  const id = asStringOrNull(body?.id) ?? asStringOrNull(record.id) ?? asStringOrNull(query?.id) ?? requestId
+  if (!id) throw new CrudHttpError(400, { error: translate('eudr.errors.statement_required', 'Due diligence statement id is required') })
+  return { id }
+}
+
+export function buildFilters(query: StatementListQuery): Record<string, unknown> {
+  const filters: Record<string, unknown> = {}
+  if (query.id) filters.id = { $eq: query.id }
+  if (query.commodity) filters.commodity = { $eq: query.commodity }
+  if (query.status) filters.status = { $eq: query.status }
+  if (query.orderId) filters.order_id = { $eq: query.orderId }
+  const search = typeof query.search === 'string' ? query.search.trim() : ''
+  if (search) {
+    const searchPattern = buildIlikeTerm(search)
+    filters.$or = [
+      { title: { $ilike: searchPattern } },
+      { reference_number: { $ilike: searchPattern } },
+    ]
+  }
+  return filters
+}
+
+function transformStatementItem(item: unknown) {
+  if (!item || typeof item !== 'object') return item
+  const record = item as Record<string, unknown>
+  return {
+    id: record.id,
+    title: record.title ?? null,
+    commodity: record.commodity ?? null,
+    referenceNumber: record.reference_number ?? null,
+    verificationNumber: record.verification_number ?? null,
+    status: record.status ?? null,
+    activityType: record.activity_type ?? null,
+    actorRole: record.actor_role ?? null,
+    referencedStatements: Array.isArray(record.referenced_statements) ? record.referenced_statements : [],
+    quantityKg: record.quantity_kg ?? null,
+    supplementaryUnit: record.supplementary_unit ?? null,
+    supplementaryQuantity: record.supplementary_quantity ?? null,
+    orderId: record.order_id ?? null,
+    submittedAt: toIsoString(record.submitted_at),
+    referenceIssuedAt: toIsoString(record.reference_issued_at),
+    orderSnapshot: record.order_snapshot ?? null,
+    notes: record.notes ?? null,
+    createdAt: toIsoString(record.created_at),
+    updatedAt: toIsoString(record.updated_at),
+  }
+}
+
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: EudrDueDiligenceStatement,
+    idField: 'id',
+    orgField: 'organizationId',
+    tenantField: 'tenantId',
+    softDeleteField: 'deletedAt',
+  },
+  indexer: { entityType: E.eudr.eudr_due_diligence_statement },
+  list: {
+    schema: listSchema,
+    entityId: E.eudr.eudr_due_diligence_statement,
+    fields: [
+      'id',
+      'title',
+      'commodity',
+      'reference_number',
+      'verification_number',
+      'status',
+      'activity_type',
+      'actor_role',
+      'referenced_statements',
+      'quantity_kg',
+      'supplementary_unit',
+      'supplementary_quantity',
+      'order_id',
+      'submitted_at',
+      'reference_issued_at',
+      'order_snapshot',
+      'notes',
+      'created_at',
+      'updated_at',
+    ],
+    sortFieldMap: {
+      created_at: 'created_at',
+      createdAt: 'created_at',
+      updated_at: 'updated_at',
+      updatedAt: 'updated_at',
+      commodity: 'commodity',
+      title: 'title',
+      status: 'status',
+      activityType: 'activity_type',
+      activity_type: 'activity_type',
+      referenceNumber: 'reference_number',
+      quantityKg: 'quantity_kg',
+    },
+    buildFilters,
+    transformItem: transformStatementItem,
+  },
+  actions: {
+    create: {
+      commandId: 'eudr.statements.create',
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations()
+        const scoped = withScopedPayload(raw ?? {}, ctx, translate)
+        const { base, custom } = splitCustomFieldPayload(scoped)
+        const parsed = statementCreateSchema.parse(base)
+        const input = { ...parsed, tenantId: scoped.tenantId, organizationId: scoped.organizationId }
+        return Object.keys(custom).length ? { ...input, customFields: custom } : input
+      },
+      response: ({ result }) => ({ id: result?.entityId ?? result?.id ?? null }),
+      status: 201,
+    },
+    update: {
+      commandId: 'eudr.statements.update',
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations()
+        const scoped = withScopedPayload(raw ?? {}, ctx, translate)
+        const { base, custom } = splitCustomFieldPayload(scoped)
+        const parsed = statementUpdateSchema.parse(base)
+        const input = { ...parsed, tenantId: scoped.tenantId, organizationId: scoped.organizationId }
+        return Object.keys(custom).length ? { ...input, customFields: custom } : input
+      },
+      response: ({ result }) => {
+        const updatedAt = result?.updatedAt
+        return {
+          ok: true,
+          updatedAt: updatedAt instanceof Date ? updatedAt.toISOString() : (typeof updatedAt === 'string' ? updatedAt : null),
+        }
+      },
+    },
+    delete: {
+      commandId: 'eudr.statements.delete',
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations()
+        return resolveDeleteInput(parsed, ctx, translate)
+      },
+      response: () => ({ ok: true }),
+    },
+  },
+  hooks: {
+    afterList: async (payload, ctx) => {
+      const items: unknown[] = Array.isArray(payload?.items) ? payload.items : []
+      if (!items.length) return
+      for (const item of items) {
+        if (item && typeof item === 'object') delete (item as Record<string, unknown>).latestRisk
+      }
+      const tenantId = ctx.auth?.tenantId ?? null
+      const userId = ctx.auth?.sub ?? null
+      const organizationIds = ctx.organizationIds ?? (ctx.selectedOrganizationId
+        ? [ctx.selectedOrganizationId]
+        : (ctx.auth?.orgId ? [ctx.auth.orgId] : null))
+      if (!tenantId || !userId || !organizationIds?.length) return
+      try {
+        const rbacService = ctx.container.resolve('rbacService') as RbacService
+        const canViewRisk = await rbacService.userHasAllFeatures(userId, ['eudr.risk.view'], {
+          tenantId,
+          organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? organizationIds[0],
+        })
+        if (!canViewRisk) return
+      } catch {
+        return
+      }
+      const statementIds = items
+        .map((item) => (item && typeof item === 'object' ? asStringOrNull((item as Record<string, unknown>).id) : null))
+        .filter((id): id is string => id !== null)
+      if (!statementIds.length) return
+      const em = ctx.container.resolve('em') as EntityManager
+      const where: FilterQuery<EudrRiskAssessment> = {
+        statementId: { $in: statementIds },
+        deletedAt: null,
+        tenantId,
+        organizationId: { $in: organizationIds },
+      }
+      const assessments = await em.find(EudrRiskAssessment, where, {
+        fields: ['id', 'statementId', 'conclusion', 'overallTier', 'reviewDueAt', 'assessedAt', 'createdAt'],
+        orderBy: { assessedAt: 'DESC', createdAt: 'DESC' },
+      })
+      const latestByStatementId = new Map<string, Pick<EudrRiskAssessment, 'id' | 'statementId' | 'conclusion' | 'overallTier' | 'reviewDueAt' | 'assessedAt' | 'createdAt'>>()
+      for (const assessment of assessments) {
+        if (latestByStatementId.has(assessment.statementId)) continue
+        latestByStatementId.set(assessment.statementId, assessment)
+      }
+      for (const item of items) {
+        if (!item || typeof item !== 'object') continue
+        const record = item as Record<string, unknown>
+        const id = asStringOrNull(record.id)
+        const latest = id ? latestByStatementId.get(id) : null
+        record.latestRisk = latest
+          ? {
+              conclusion: latest.conclusion,
+              overallTier: latest.overallTier,
+              reviewDueAt: toIsoString(latest.reviewDueAt),
+            }
+          : null
+      }
+    },
+  },
+})
+
+export const GET = crud.GET
+export const POST = crud.POST
+export const PUT = crud.PUT
+export const DELETE = crud.DELETE
+
+const statementListItemSchema = z.object({
+  id: z.string().uuid(),
+  title: z.string().nullable().optional(),
+  commodity: z.enum(EUDR_COMMODITIES).nullable().optional(),
+  referenceNumber: z.string().nullable().optional(),
+  verificationNumber: z.string().nullable().optional(),
+  status: z.enum(EUDR_STATEMENT_STATUSES).nullable().optional(),
+  activityType: z.enum(EUDR_ACTIVITY_TYPES).nullable().optional(),
+  actorRole: z.enum(EUDR_ACTOR_ROLES).nullable().optional(),
+  referencedStatements: z.array(z.object({
+    referenceNumber: z.string(),
+    verificationNumber: z.string().nullable().optional(),
+  })).optional(),
+  quantityKg: z.union([z.string(), z.number()]).nullable().optional(),
+  supplementaryUnit: z.string().nullable().optional(),
+  supplementaryQuantity: z.union([z.string(), z.number()]).nullable().optional(),
+  orderId: z.string().uuid().nullable().optional(),
+  submittedAt: z.string().nullable().optional(),
+  referenceIssuedAt: z.string().nullable().optional(),
+  orderSnapshot: z.object({
+    orderNumber: z.string().nullable().optional(),
+  }).nullable().optional(),
+  notes: z.string().nullable().optional(),
+  latestRisk: z.object({
+    conclusion: z.enum(EUDR_RISK_CONCLUSIONS),
+    overallTier: z.enum(EUDR_RISK_TIERS),
+    reviewDueAt: z.string().nullable(),
+  }).nullable().optional(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional(),
+})
+
+export const openApi = createEudrCrudOpenApi({
+  resourceName: 'Due diligence statement',
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(statementListItemSchema),
+  create: {
+    schema: statementCreateSchema,
+    description: 'Creates an EUDR due diligence statement for the scoped organization.',
+  },
+  update: {
+    schema: statementUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: 'Updates an EUDR due diligence statement.',
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: 'Deletes an EUDR due diligence statement by id. Request body or query may provide the identifier.',
+  },
+})

package/src/modules/eudr/api/suppliers/compliance/route.ts

@@ -0,0 +1,241 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { sql } from 'kysely'
+import { z } from 'zod'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { EUDR_SUBMISSION_STATUSES } from '../../../data/validators'
+
+const logger = createLogger('eudr')
+
+const querySchema = z.object({
+  supplierEntityId: z.string().uuid(),
+})
+
+const responseSchema = z.object({
+  submissions: z.object({
+    total: z.number().int().nonnegative(),
+    byStatus: z.record(z.string(), z.number().int().nonnegative()),
+    avgCompleteness: z.number().int().min(0).max(100).nullable(),
+  }),
+  lastSubmissionAt: z.string().datetime().nullable(),
+  plots: z.object({
+    total: z.number().int().nonnegative(),
+    withWarnings: z.number().int().nonnegative(),
+  }).optional(),
+})
+
+const errorSchema = z.object({ error: z.string() })
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['eudr.submissions.view'] },
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'EUDR',
+  summary: 'EUDR supplier compliance aggregate',
+  methods: {
+    GET: {
+      summary: 'Get supplier compliance readiness',
+      description: 'Returns organization-scoped EUDR submission and permitted plot aggregates for a supplier.',
+      query: querySchema,
+      responses: [
+        { status: 200, description: 'Supplier compliance readiness', schema: responseSchema },
+        { status: 400, description: 'Invalid query or organization context', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+        { status: 500, description: 'Failed to load supplier compliance readiness', schema: errorSchema },
+      ],
+    },
+  },
+}
+
+type SupplierComplianceDatabase = {
+  eudr_evidence_submissions: {
+    supplier_entity_id: string
+    tenant_id: string
+    organization_id: string
+    status: string
+    completeness_score: number
+    created_at: Date
+    deleted_at: Date | null
+  }
+  eudr_plots: {
+    supplier_entity_id: string
+    tenant_id: string
+    organization_id: string
+    validation_warnings: unknown
+    is_active: boolean
+    deleted_at: Date | null
+  }
+}
+
+type RequestContext = {
+  em: EntityManager
+  tenantId: string
+  organizationId: string
+  hasFeature: (feature: string) => Promise<boolean>
+}
+
+type CountValue = string | number | bigint | null | undefined
+
+function normalizeCount(value: CountValue): number {
+  const parsed = typeof value === 'bigint' ? Number(value) : Number(value ?? 0)
+  return Number.isFinite(parsed) && parsed >= 0 ? Math.trunc(parsed) : 0
+}
+
+function normalizeNullableInteger(value: CountValue): number | null {
+  if (value === null || value === undefined) return null
+  const parsed = typeof value === 'bigint' ? Number(value) : Number(value)
+  return Number.isFinite(parsed) ? Math.round(parsed) : null
+}
+
+function normalizeDateTime(value: Date | string | null | undefined): string | null {
+  if (value === null || value === undefined) return null
+  const date = value instanceof Date ? value : new Date(value)
+  return Number.isNaN(date.getTime()) ? null : date.toISOString()
+}
+
+async function resolveRequestContext(req: Request): Promise<RequestContext> {
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+
+  if (!auth?.tenantId) {
+    throw new CrudHttpError(401, {
+      error: translate('eudr.errors.unauthorized', 'Unauthorized'),
+    })
+  }
+
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  if (!organizationId) {
+    throw new CrudHttpError(400, {
+      error: translate('eudr.errors.organization_required', 'Organization context is required'),
+    })
+  }
+
+  let rbacService: RbacService | null
+  try {
+    rbacService = container.resolve('rbacService') as RbacService
+  } catch {
+    rbacService = null
+  }
+
+  const tenantId = auth.tenantId
+  const userId = auth.sub ?? null
+
+  return {
+    em: container.resolve('em') as EntityManager,
+    tenantId,
+    organizationId,
+    hasFeature: async (feature: string) => {
+      if (!rbacService || !userId) return false
+      try {
+        return await rbacService.userHasAllFeatures(userId, [feature], { tenantId, organizationId })
+      } catch {
+        return false
+      }
+    },
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const ctx = await resolveRequestContext(req)
+    const { translate } = await resolveTranslations()
+    const parsedQuery = querySchema.safeParse(Object.fromEntries(new URL(req.url).searchParams))
+    if (!parsedQuery.success) {
+      throw new CrudHttpError(400, {
+        error: translate('eudr.errors.invalid_query', 'Invalid query'),
+      })
+    }
+
+    const { supplierEntityId } = parsedQuery.data
+    const db = ctx.em.getKysely<SupplierComplianceDatabase>()
+    const submissionScope = db
+      .selectFrom('eudr_evidence_submissions')
+      .where('supplier_entity_id', '=', supplierEntityId)
+      .where('tenant_id', '=', ctx.tenantId)
+      .where('organization_id', '=', ctx.organizationId)
+      .where('deleted_at', 'is', null)
+
+    const [submissionTotals, submissionStatusRows, canViewPlots] = await Promise.all([
+      submissionScope
+        .select([
+          sql<CountValue>`count(*)`.as('total'),
+          sql<CountValue>`round(avg(completeness_score))`.as('avg_completeness'),
+          sql<Date | string | null>`max(created_at)`.as('last_submission_at'),
+        ])
+        .executeTakeFirst(),
+      submissionScope
+        .select([
+          'status',
+          sql<CountValue>`count(*)`.as('total'),
+        ])
+        .groupBy('status')
+        .execute(),
+      ctx.hasFeature('eudr.plots.view'),
+    ])
+
+    const byStatus: Record<string, number> = Object.fromEntries(
+      EUDR_SUBMISSION_STATUSES.map((status) => [status, 0]),
+    )
+    for (const row of submissionStatusRows) {
+      if (!EUDR_SUBMISSION_STATUSES.includes(row.status as (typeof EUDR_SUBMISSION_STATUSES)[number])) continue
+      byStatus[row.status] = normalizeCount(row.total)
+    }
+
+    let plots: { total: number; withWarnings: number } | undefined
+    if (canViewPlots) {
+      const plotCounts = await db
+        .selectFrom('eudr_plots')
+        .select([
+          sql<CountValue>`count(*)`.as('total'),
+          sql<CountValue>`count(*) filter (where jsonb_array_length(validation_warnings) > 0)`.as('with_warnings'),
+        ])
+        .where('supplier_entity_id', '=', supplierEntityId)
+        .where('tenant_id', '=', ctx.tenantId)
+        .where('organization_id', '=', ctx.organizationId)
+        .where('deleted_at', 'is', null)
+        .where('is_active', '=', true)
+        .executeTakeFirst()
+
+      plots = {
+        total: normalizeCount(plotCounts?.total),
+        withWarnings: normalizeCount(plotCounts?.with_warnings),
+      }
+    }
+
+    const response = responseSchema.parse({
+      submissions: {
+        total: normalizeCount(submissionTotals?.total),
+        byStatus,
+        avgCompleteness: normalizeNullableInteger(submissionTotals?.avg_completeness),
+      },
+      lastSubmissionAt: normalizeDateTime(submissionTotals?.last_submission_at),
+      ...(plots ? { plots } : {}),
+    })
+
+    return Response.json(response)
+  } catch (error) {
+    if (isCrudHttpError(error)) {
+      return Response.json(error.body, { status: error.status })
+    }
+
+    logger.error('Supplier compliance aggregate failed', {
+      component: 'api/suppliers/compliance',
+      err: error,
+    })
+    const { translate } = await resolveTranslations()
+    return Response.json(
+      { error: translate('eudr.errors.compliance_overview_failed', 'Failed to load EUDR compliance overview') },
+      { status: 500 },
+    )
+  }
+}